Edit tour

Linux Analysis Report
t6.elf

Overview

General Information

Sample name:t6.elf
Analysis ID:1589832
MD5:7db589ac12c48830edc896e5a72172ec
SHA1:d7c4b7525c05f81d8bf3bd969909b1bd9064f729
SHA256:0787b187057248b0badadc13b1b65e942fc3ced46673ba3e20f11270acce2267
Tags:elfuser-abuse_ch
Infos:

Detection

Score:48
Range:0 - 100
Whitelisted:false

Signatures

Multi AV Scanner detection for submitted file
Enumerates processes within the "proc" file system
Sample has stripped symbol table
Sample tries to kill a process (SIGKILL)
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious
Joe Sandbox version:42.0.0 Malachite
Analysis ID:1589832
Start date and time:2025-01-13 08:19:51 +01:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 4m 41s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Sample name:t6.elf
Detection:MAL
Classification:mal48.linELF@0/0@2/0
Command:/tmp/t6.elf
PID:5538
Exit Code:139
Exit Code Info:SIGSEGV (11) Segmentation fault invalid memory reference
Killed:False
Standard Output:

Standard Error:qemu: uncaught target signal 11 (Segmentation fault) - core dumped
  • system is lnxubuntu20
  • t6.elf (PID: 5538, Parent: 5455, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/t6.elf
  • cleanup
No yara matches
No Suricata rule has matched

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Source: t6.elfReversingLabs: Detection: 28%
Source: global trafficTCP traffic: 192.168.2.14:46540 -> 185.125.190.26:443
Source: unknownTCP traffic detected without corresponding DNS query: 185.125.190.26
Source: unknownTCP traffic detected without corresponding DNS query: 185.125.190.26
Source: global trafficDNS traffic detected: DNS query: daisy.ubuntu.com
Source: t6.elf, 5538.1.00007fa080035000.00007fa08003a000.rw-.sdmpString found in binary or memory: http://1/wget.sh
Source: t6.elf, 5538.1.00007fa080035000.00007fa08003a000.rw-.sdmpString found in binary or memory: http://9/curl.sh
Source: t6.elf, 5538.1.00007fa080035000.00007fa08003a000.rw-.sdmpString found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: t6.elf, 5538.1.00007fa080035000.00007fa08003a000.rw-.sdmpString found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: unknownNetwork traffic detected: HTTP traffic on port 46540 -> 443
Source: ELF static info symbol of initial sample.symtab present: no
Source: /tmp/t6.elf (PID: 5538)SIGKILL sent: pid: 888, result: successfulJump to behavior
Source: classification engineClassification label: mal48.linELF@0/0@2/0
Source: /tmp/t6.elf (PID: 5538)File opened: /proc/490/cmdlineJump to behavior
Source: /tmp/t6.elf (PID: 5538)File opened: /proc/490/cmdlineJump to behavior
Source: /tmp/t6.elf (PID: 5538)File opened: /proc/780/cmdlineJump to behavior
Source: /tmp/t6.elf (PID: 5538)File opened: /proc/780/cmdlineJump to behavior
Source: /tmp/t6.elf (PID: 5538)File opened: /proc/791/cmdlineJump to behavior
Source: /tmp/t6.elf (PID: 5538)File opened: /proc/791/cmdlineJump to behavior
Source: /tmp/t6.elf (PID: 5538)File opened: /proc/1/cmdlineJump to behavior
Source: /tmp/t6.elf (PID: 5538)File opened: /proc/1/cmdlineJump to behavior
Source: /tmp/t6.elf (PID: 5538)File opened: /proc/661/cmdlineJump to behavior
Source: /tmp/t6.elf (PID: 5538)File opened: /proc/661/cmdlineJump to behavior
Source: /tmp/t6.elf (PID: 5538)File opened: /proc/782/cmdlineJump to behavior
Source: /tmp/t6.elf (PID: 5538)File opened: /proc/782/cmdlineJump to behavior
Source: /tmp/t6.elf (PID: 5538)File opened: /proc/794/cmdlineJump to behavior
Source: /tmp/t6.elf (PID: 5538)File opened: /proc/794/cmdlineJump to behavior
Source: /tmp/t6.elf (PID: 5538)File opened: /proc/795/cmdlineJump to behavior
Source: /tmp/t6.elf (PID: 5538)File opened: /proc/795/cmdlineJump to behavior
Source: /tmp/t6.elf (PID: 5538)File opened: /proc/785/cmdlineJump to behavior
Source: /tmp/t6.elf (PID: 5538)File opened: /proc/785/cmdlineJump to behavior
Source: /tmp/t6.elf (PID: 5538)File opened: /proc/797/cmdlineJump to behavior
Source: /tmp/t6.elf (PID: 5538)File opened: /proc/797/cmdlineJump to behavior
Source: /tmp/t6.elf (PID: 5538)File opened: /proc/853/cmdlineJump to behavior
Source: /tmp/t6.elf (PID: 5538)File opened: /proc/853/cmdlineJump to behavior
Source: /tmp/t6.elf (PID: 5538)File opened: /proc/767/cmdlineJump to behavior
Source: /tmp/t6.elf (PID: 5538)File opened: /proc/767/cmdlineJump to behavior
Source: /tmp/t6.elf (PID: 5538)File opened: /proc/800/cmdlineJump to behavior
Source: /tmp/t6.elf (PID: 5538)File opened: /proc/800/cmdlineJump to behavior
Source: /tmp/t6.elf (PID: 5538)File opened: /proc/888/cmdlineJump to behavior
Source: /tmp/t6.elf (PID: 5538)File opened: /proc/888/cmdlineJump to behavior
Source: /tmp/t6.elf (PID: 5538)File opened: /proc/801/cmdlineJump to behavior
Source: /tmp/t6.elf (PID: 5538)File opened: /proc/801/cmdlineJump to behavior
Source: /tmp/t6.elf (PID: 5538)File opened: /proc/725/cmdlineJump to behavior
Source: /tmp/t6.elf (PID: 5538)File opened: /proc/725/cmdlineJump to behavior
Source: /tmp/t6.elf (PID: 5538)File opened: /proc/769/cmdlineJump to behavior
Source: /tmp/t6.elf (PID: 5538)File opened: /proc/769/cmdlineJump to behavior
Source: /tmp/t6.elf (PID: 5538)File opened: /proc/726/cmdlineJump to behavior
Source: /tmp/t6.elf (PID: 5538)File opened: /proc/726/cmdlineJump to behavior
Source: /tmp/t6.elf (PID: 5538)File opened: /proc/803/cmdlineJump to behavior
Source: /tmp/t6.elf (PID: 5538)File opened: /proc/803/cmdlineJump to behavior
Source: /tmp/t6.elf (PID: 5538)File opened: /proc/5538/statusJump to behavior
Source: /tmp/t6.elf (PID: 5538)File opened: /proc/806/cmdlineJump to behavior
Source: /tmp/t6.elf (PID: 5538)File opened: /proc/806/cmdlineJump to behavior
Source: /tmp/t6.elf (PID: 5538)File opened: /proc/807/cmdlineJump to behavior
Source: /tmp/t6.elf (PID: 5538)File opened: /proc/807/cmdlineJump to behavior
Source: /tmp/t6.elf (PID: 5538)Queries kernel information via 'uname': Jump to behavior
Source: t6.elf, 5538.1.00007ffee5d2c000.00007ffee5d4d000.rw-.sdmpBinary or memory string: x86_64/usr/bin/qemu-arm/tmp/t6.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/t6.elf
Source: t6.elf, 5538.1.0000564285b34000.0000564285c86000.rw-.sdmpBinary or memory string: /etc/qemu-binfmt/arm
Source: t6.elf, 5538.1.00007ffee5d2c000.00007ffee5d4d000.rw-.sdmpBinary or memory string: /usr/bin/qemu-arm
Source: t6.elf, 5538.1.0000564285b34000.0000564285c86000.rw-.sdmpBinary or memory string: BV!/etc/qemu-binfmt/arm
Source: t6.elf, 5538.1.00007ffee5d2c000.00007ffee5d4d000.rw-.sdmpBinary or memory string: qemu: uncaught target signal 11 (Segmentation fault) - core dumped
ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management InstrumentationPath InterceptionPath InterceptionDirect Volume Access1
OS Credential Dumping
11
Security Software Discovery
Remote ServicesData from Local System1
Encrypted Channel
Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsRootkitLSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media1
Non-Application Layer Protocol
Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive2
Application Layer Protocol
Automated ExfiltrationData Encrypted for Impact
No configs have been found
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Number of created Files
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1589832 Sample: t6.elf Startdate: 13/01/2025 Architecture: LINUX Score: 48 8 185.125.190.26, 443 CANONICAL-ASGB United Kingdom 2->8 10 daisy.ubuntu.com 2->10 12 Multi AV Scanner detection for submitted file 2->12 6 t6.elf 2->6         started        signatures3 process4

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand
SourceDetectionScannerLabelLink
t6.elf29%ReversingLabsLinux.Backdoor.Mirai
No Antivirus matches
No Antivirus matches
No Antivirus matches

Download Network PCAP: filteredfull

NameIPActiveMaliciousAntivirus DetectionReputation
daisy.ubuntu.com
162.213.35.24
truefalse
    high
    NameSourceMaliciousAntivirus DetectionReputation
    http://1/wget.sht6.elf, 5538.1.00007fa080035000.00007fa08003a000.rw-.sdmpfalse
      high
      http://schemas.xmlsoap.org/soap/encoding/t6.elf, 5538.1.00007fa080035000.00007fa08003a000.rw-.sdmpfalse
        high
        http://9/curl.sht6.elf, 5538.1.00007fa080035000.00007fa08003a000.rw-.sdmpfalse
          high
          http://schemas.xmlsoap.org/soap/envelope/t6.elf, 5538.1.00007fa080035000.00007fa08003a000.rw-.sdmpfalse
            high
            • No. of IPs < 25%
            • 25% < No. of IPs < 50%
            • 50% < No. of IPs < 75%
            • 75% < No. of IPs
            IPDomainCountryFlagASNASN NameMalicious
            185.125.190.26
            unknownUnited Kingdom
            41231CANONICAL-ASGBfalse
            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
            185.125.190.26boatnet.arc.elfGet hashmaliciousMiraiBrowse
              boatnet.arm6.elfGet hashmaliciousMiraiBrowse
                ppc.elfGet hashmaliciousUnknownBrowse
                  t5.elfGet hashmaliciousUnknownBrowse
                    t6.elfGet hashmaliciousUnknownBrowse
                      na.elfGet hashmaliciousPrometeiBrowse
                        Cinquento.spc.elfGet hashmaliciousMiraiBrowse
                          Cinquento.mips.elfGet hashmaliciousMiraiBrowse
                            boatnet.arm7.elfGet hashmaliciousMiraiBrowse
                              boatnet.x86.elfGet hashmaliciousMiraiBrowse
                                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                daisy.ubuntu.comboatnet.m68k.elfGet hashmaliciousMiraiBrowse
                                • 162.213.35.24
                                boatnet.mpsl.elfGet hashmaliciousMiraiBrowse
                                • 162.213.35.24
                                boatnet.mips.elfGet hashmaliciousMiraiBrowse
                                • 162.213.35.24
                                boatnet.sh4.elfGet hashmaliciousMiraiBrowse
                                • 162.213.35.25
                                boatnet.arm.elfGet hashmaliciousMiraiBrowse
                                • 162.213.35.24
                                boatnet.ppc.elfGet hashmaliciousMiraiBrowse
                                • 162.213.35.24
                                boatnet.arm6.elfGet hashmaliciousMiraiBrowse
                                • 162.213.35.24
                                t6.elfGet hashmaliciousUnknownBrowse
                                • 162.213.35.24
                                t5.elfGet hashmaliciousUnknownBrowse
                                • 162.213.35.24
                                byte.arm6.elfGet hashmaliciousMirai, OkiruBrowse
                                • 162.213.35.25
                                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                CANONICAL-ASGBboatnet.spc.elfGet hashmaliciousMiraiBrowse
                                • 91.189.91.42
                                boatnet.arm7.elfGet hashmaliciousMiraiBrowse
                                • 91.189.91.42
                                boatnet.arc.elfGet hashmaliciousMiraiBrowse
                                • 185.125.190.26
                                boatnet.arm6.elfGet hashmaliciousMiraiBrowse
                                • 185.125.190.26
                                boatnet.x86.elfGet hashmaliciousMiraiBrowse
                                • 91.189.91.42
                                t1.elfGet hashmaliciousUnknownBrowse
                                • 91.189.91.42
                                t3.elfGet hashmaliciousUnknownBrowse
                                • 91.189.91.42
                                12.elfGet hashmaliciousUnknownBrowse
                                • 91.189.91.42
                                g5.elfGet hashmaliciousUnknownBrowse
                                • 91.189.91.42
                                ppc.elfGet hashmaliciousUnknownBrowse
                                • 185.125.190.26
                                No context
                                No context
                                No created / dropped files found
                                File type:ELF 32-bit LSB executable, ARM, EABI4 version 1 (SYSV), statically linked, stripped
                                Entropy (8bit):6.113719063811208
                                TrID:
                                • ELF Executable and Linkable format (generic) (4004/1) 100.00%
                                File name:t6.elf
                                File size:89'652 bytes
                                MD5:7db589ac12c48830edc896e5a72172ec
                                SHA1:d7c4b7525c05f81d8bf3bd969909b1bd9064f729
                                SHA256:0787b187057248b0badadc13b1b65e942fc3ced46673ba3e20f11270acce2267
                                SHA512:a3b03edfc48ac5a51e83460994a0e2ec71c6fb031e5d5f767ee2ee68b880ab4bc92544f352649439bfe2f8471edb74d036593d26c268421830271ed5cc4a0e68
                                SSDEEP:1536:cmn2EENzVHw1RVJUqJYK8eBhocLSJgUmvVZllZ7ilW+URUlnNIZgTeg:0ypUcY0hocLSJ2ZMW+UClNJT
                                TLSH:1593195AF9819B41C4D515BBBE1E529E33076BA8E3EA3213DD201B2533CAA1F0F77506
                                File Content Preview:.ELF..............(.........4....[......4. ...(........p.U..........................................$V..$V..............$V..$V..$V......L9..............(V..(V..(V..................Q.td..................................-...L..................@-.,@...0....S

                                ELF header

                                Class:ELF32
                                Data:2's complement, little endian
                                Version:1 (current)
                                Machine:ARM
                                Version Number:0x1
                                Type:EXEC (Executable file)
                                OS/ABI:UNIX - System V
                                ABI Version:0
                                Entry Point Address:0x8194
                                Flags:0x4000002
                                ELF Header Size:52
                                Program Header Offset:52
                                Program Header Size:32
                                Number of Program Headers:5
                                Section Header Offset:89012
                                Section Header Size:40
                                Number of Section Headers:16
                                Header String Table Index:15
                                NameTypeAddressOffsetSizeEntSizeFlagsFlags DescriptionLinkInfoAlign
                                NULL0x00x00x00x00x0000
                                .initPROGBITS0x80d40xd40x100x00x6AX004
                                .textPROGBITS0x80f00xf00x13b8c0x00x6AX0016
                                .finiPROGBITS0x1bc7c0x13c7c0x100x00x6AX004
                                .rodataPROGBITS0x1bc8c0x13c8c0x18680x00x2A004
                                .ARM.extabPROGBITS0x1d4f40x154f40x180x00x2A004
                                .ARM.exidxARM_EXIDX0x1d50c0x1550c0x1180x00x82AL204
                                .eh_framePROGBITS0x256240x156240x40x00x3WA004
                                .tbssNOBITS0x256280x156280x80x00x403WAT004
                                .init_arrayINIT_ARRAY0x256280x156280x40x00x3WA004
                                .fini_arrayFINI_ARRAY0x2562c0x1562c0x40x00x3WA004
                                .gotPROGBITS0x256340x156340xa80x40x3WA004
                                .dataPROGBITS0x256dc0x156dc0x43c0x00x3WA004
                                .bssNOBITS0x25b180x15b180x34580x00x3WA004
                                .ARM.attributesARM_ATTRIBUTES0x00x15b180x160x00x0001
                                .shstrtabSTRTAB0x00x15b2e0x830x00x0001
                                TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
                                EXIDX0x1550c0x1d50c0x1d50c0x1180x1184.44000x4R 0x4.ARM.exidx
                                LOAD0x00x80000x80000x156240x156246.10570x5R E0x8000.init .text .fini .rodata .ARM.extab .ARM.exidx
                                LOAD0x156240x256240x256240x4f40x394c6.20030x6RW 0x8000.eh_frame .tbss .init_array .fini_array .got .data .bss
                                TLS0x156280x256280x256280x00x80.00000x4R 0x4.tbss
                                GNU_STACK0x00x00x00x00x00.00000x7RWE0x4

                                Download Network PCAP: filteredfull

                                • Total Packets: 4
                                • 443 (HTTPS)
                                • 53 (DNS)
                                TimestampSource PortDest PortSource IPDest IP
                                Jan 13, 2025 08:20:55.281239033 CET46540443192.168.2.14185.125.190.26
                                Jan 13, 2025 08:21:26.000096083 CET46540443192.168.2.14185.125.190.26
                                TimestampSource PortDest PortSource IPDest IP
                                Jan 13, 2025 08:20:49.265219927 CET4462553192.168.2.148.8.8.8
                                Jan 13, 2025 08:20:49.265273094 CET4310453192.168.2.148.8.8.8
                                Jan 13, 2025 08:20:49.271744967 CET53431048.8.8.8192.168.2.14
                                Jan 13, 2025 08:20:49.272237062 CET53446258.8.8.8192.168.2.14
                                TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                Jan 13, 2025 08:20:49.265219927 CET192.168.2.148.8.8.80xedbfStandard query (0)daisy.ubuntu.comA (IP address)IN (0x0001)false
                                Jan 13, 2025 08:20:49.265273094 CET192.168.2.148.8.8.80x565Standard query (0)daisy.ubuntu.com28IN (0x0001)false
                                TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                Jan 13, 2025 08:20:49.272237062 CET8.8.8.8192.168.2.140xedbfNo error (0)daisy.ubuntu.com162.213.35.24A (IP address)IN (0x0001)false
                                Jan 13, 2025 08:20:49.272237062 CET8.8.8.8192.168.2.140xedbfNo error (0)daisy.ubuntu.com162.213.35.25A (IP address)IN (0x0001)false

                                System Behavior

                                Start time (UTC):07:20:46
                                Start date (UTC):13/01/2025
                                Path:/tmp/t6.elf
                                Arguments:/tmp/t6.elf
                                File size:4956856 bytes
                                MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1